Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns

Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns.

Shubham Shah, co-founder at Assetnote, and researcher Sam Curry worked together on the exploits earlier this year. By tinkering with the cars’ Android apps, they devised exploit paths to issue remote commands to vehicles in Australia and the US.

The pair published separate blogs covering different aspects of the research; Shah said the US attack "required a lot more work" because the automaker "spent much more time securing the US, Canadian, and European OpenIDM environments."

Both exploit chains centered around weaknesses in the ForgeRock identity platform relied upon by both automakers, the identities of which were kept anonymous by the researchers, who have previously highlighted flaws in the likes of Hyundai, Kia, Subaru, and many others.

In the Australian version of the app, the researchers first found a vehicle identification number (VIN) …